Threats tagged 'ghsa-mgh3-39q6-f7mx'

OpenEMR versions prior to 8.3.0 have a critical path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method within the oe-module-faxsms. Authenticated attackers can exploit the file_path parameter to read and write arbitrary files. Using the action=download parameter, attackers can read sensitive files such as credentials and source code. Using action=setup with base64-encoded content, attackers can write web-executable files, enabling remote code execution.